Description

The s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 260814 via the 'first_name' parameter parameter. This is due to insufficient sanitization of the first_name parameter via esc_refs(), which strips only regex backreferences and not PHP tags, before substitution into the eval'd Signup Tracking Codes template, combined with disclosure of the site-global proxy verification key that allows PayPal postback verification to be bypassed. This makes it possible for unauthenticated attackers to execute code on the server. Successful exploitation requires that the site administrator has configured a Signup Tracking Codes template containing the %%first_name%% placeholder (a documented, GUI-supported feature) and that the attacker has obtained the site-global proxy verification key, which is exposed in plaintext in the JSON response of any PayPal Checkout AJAX request on the target site.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-25T08:16:40.383Z",
  "pubdate": "2026-09-25T08:16:40.383Z",
  "executiveSummary": "The s2Member plugin for WordPress (versions up to and including 260814) contains a critical Remote Code Execution (RCE) vulnerability. This flaw stems from improper input sanitization within the 'first_name' parameter, which is processed by the plugin's template engine.\nThe vulnerability allows unauthenticated attackers to execute arbitrary PHP code on the underlying server. Successful exploitation facilitates complete system compromise, enabling attackers to gain unauthorized access, modify site data, or establish persistent backdoors.\nThe attack vector relies on a two-fold dependency: the site administrator must have configured a Signup Tracking Codes template using the %%first_name%% placeholder, and the attacker must successfully exfiltrate the site-global proxy verification key. This key is inadvertently exposed via plaintext within JSON responses from PayPal Checkout AJAX requests. Consequently, an attacker can bypass the intended PayPal postback verification mechanisms to facilitate malicious payload delivery.\nGiven that this vulnerability requires no authentication and permits remote command execution, it carries a maximum severity risk rating. Organizations utilizing affected versions of s2Member are exposed to significant threats, including data breaches and total server takeover if the exploitation prerequisites are met.",
  "technicalDetails": "The vulnerability resides in the way the s2Member plugin handles the 'first_name' parameter during the processing of Signup Tracking Codes. When an administrator utilizes the built-in GUI to define tracking templates, these templates are processed via an eval-based mechanism. The 'first_name' variable is passed into this template rendering process after being processed by the esc_refs() function.\nThe core issue is that esc_refs() performs insufficient sanitization. While it is intended to strip regex backreferences to prevent unintended string manipulation, it fails to filter or escape PHP tags or other executable code sequences. Because the application then incorporates this user-supplied input into an eval() call, any injected PHP code is executed within the context of the web server.\nTo trigger this execution, an attacker must successfully bypass the PayPal postback verification system. This is achieved by leveraging the site-global proxy verification key. The application exposes this sensitive cryptographic material in the JSON response body of any PayPal Checkout AJAX request. An unauthenticated attacker can observe this traffic to retrieve the key in plaintext.\nThe attack flow follows these distinct phases: First, the attacker identifies a site utilizing s2Member with a configured Signup Tracking Code template containing the %%first_name%% placeholder. Second, the attacker captures the PayPal Checkout AJAX response to exfiltrate the proxy verification key. Third, the attacker crafts a malicious request containing a PHP payload within the 'first_name' parameter, signed or formatted to bypass the verification logic using the stolen key. Finally, the server-side eval() function processes the template, resulting in the execution of the injected code.\nThe exploitation is feasible from any remote network location and requires no prior administrative or subscriber-level privileges. The post-exploitation impact is severe, as the attacker operates with the permissions of the web server user, allowing for arbitrary file system access, database manipulation, or lateral movement within the hosting environment. The vulnerability persists across all versions up to 260814."
}